Re: [GENERAL] SQL Injection possible on custom functions

2005-02-14 Thread Tom Lane
"Bogdan Tomchuk" <[EMAIL PROTECTED]> writes: > My question is: if we imagine that input of UpdateAccount has no = > filtration or this filtration incorrect does exist any way to modify = > other then authorized parameters of Accounts table or records of other = > user? Is there any injection techn

[GENERAL] SQL Injection possible on custom functions

2005-02-14 Thread Bogdan Tomchuk
I have one question that I cannot figure out 100% sure answer.   Lets say that in schema Main I have following table:   CREATE TABLE Accounts ( UID   char(43) PRIMARY KEY CHECK ( UID <> '' ), Login varchar(320) UNIQUE NOT NULL CHECK ( Login <> '' ), Password  char(32) N